symsrv[.]dll | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

symsrv.dll
Size

193KB
MD5

cae67c24308aa631784b44096727f5c5
SHA1

6248ffc8d8b852da4318140480cf1c044fac5ff2
SHA256

51da071bab34abc9db349b471f24e06697cfa65f6f74e4cd995e09cf9e96bc35
SHA512

0bf3fb2cb5632ce0099cb099b6c10fd9e083c006cbefdb1333c8b7c162b22c31d57528cf4633eab07e5c8cfe4efd13a382f6aef1b7b8c62273cce8ca3df08292
SSDEEP

3072:Dh89cklYH7jh4y7IdvfXpDw0/6+RJa8KNMm9qTuyb/kdR+Hco6Pg:DSfA76y7Q3Xy0iUb8dtg

Score

1^/10

Malware Config

Signatures

Files

symsrv.dll
.dll windows x64

9ece4e7482be4ab6b4d79909aa1d087a

Code Sign

33:00:00:00:cc:cb:b8:13:eb:5d:72:2d:45:00:00:00:00:00:cc
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/09/2016, 17:58

Not After

07/09/2018, 17:58

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:148C-C4B9-2066,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/08/2016, 20:17

Not After

02/11/2017, 20:17

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:4f:e7:c6:62:c9:46:f4:a9:7f:00:00:00:00:01:4f
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

17/11/2016, 21:59

Not After

17/02/2018, 21:59

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

26:69:05:6d:f1:b4:bd:67:4e:e2:00:b6:79:59:45:0d:f5:c2:d2:8c:6d:14:ea:19:b6:f0:b4:b7:40:c9:f6:a2
Signer

Actual PE Digest

26:69:05:6d:f1:b4:bd:67:4e:e2:00:b6:79:59:45:0d:f5:c2:d2:8c:6d:14:ea:19:b6:f0:b4:b7:40:c9:f6:a2

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

13/04/2023, 18:10
Valid: false

10:c6:43:d2:ca:46:65:3f:6c:34:82:05:a3:66:e6:ba:17:22:bf:8b
Signer

Actual PE Digest

10:c6:43:d2:ca:46:65:3f:6c:34:82:05:a3:66:e6:ba:17:22:bf:8b

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

18/03/2017, 09:29
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

wcscat_s
isspace
__CxxFrameHandler3
_CxxThrowException
?what@exception@@UEBAPEBDXZ
??1type_info@@UEAA@XZ
wcscpy_s
_wcslwr
strrchr
towlower
malloc
strcat_s
strcpy_s
_onexit
memcpy
wcsstr
free
_wcsdup
_stricmp
fclose
swprintf_s
??3@YAXPEAX@Z
vswprintf_s
tolower
_wsplitpath_s
_wmakepath_s
_vsnwprintf_s
iswprint
__dllonexit
_unlock
_XcptFilter
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
_amsg_exit
_initterm
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
iswspace
memmove
_purecall
_wfopen
fgetws
_callnewh
swscanf_s
_wcsicmp
wcsrchr
??_V@YAXPEAX@Z
_vsnwprintf
__C_specific_handler
wcsncpy_s
_wcsnicmp
wcschr
getenv
_wtoi64
_lock
memset
wcscmp

api-ms-win-security-base-l1-1-0

EqualSid
FreeSid
AllocateAndInitializeSid
GetTokenInformation

api-ms-win-core-file-l1-1-0

LocalFileTimeToFileTime
GetDriveTypeW
GetFileAttributesExW
GetFileTime
WriteFile
GetFileAttributesW
CreateFileW
ReadFile
SetFileTime
DeleteFileW
RemoveDirectoryW
GetFileSize
FileTimeToLocalFileTime
DeleteFileA
CreateFileA
SetFilePointer
GetFileInformationByHandle
CreateDirectoryW

api-ms-win-core-errorhandling-l1-1-0

RaiseException
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
GetLastError
SetErrorMode

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
OpenProcessToken
CreateThread
GetCurrentThreadId
GetCurrentProcess
TerminateProcess

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW
GetEnvironmentVariableW

api-ms-win-core-misc-l1-1-0

LocalFree
LocalReAlloc
GlobalFree
LocalAlloc
Sleep
FormatMessageW

api-ms-win-core-sysinfo-l1-1-0

GetVersionExW
GetSystemInfo
GetTickCount
GetSystemTime
GetSystemTimeAsFileTime
GetSystemDirectoryW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-libraryloader-l1-1-0

LoadLibraryExA
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
LoadLibraryExW
GetModuleHandleExW
FreeLibrary

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection
WaitForSingleObject
AcquireSRWLockExclusive
EnterCriticalSection
ReleaseSRWLockExclusive
LeaveCriticalSection
InitializeCriticalSection
OpenMutexW
ReleaseMutex
SetWaitableTimer

api-ms-win-core-localregistry-l1-1-0

RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegEnumValueW

ws2_32

GetAddrInfoW
WSAStartup
FreeAddrInfoW
WSACleanup

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

advapi32

EventWriteTransfer
EventRegister
EventActivityIdControl

api-ms-win-core-memory-l1-1-0

VirtualProtect
VirtualQuery

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapAlloc

ntdll

RtlRunOnceExecuteOnce

Exports

Exports

EulaDlgProc
RunDllEntry
SymbolServer
SymbolServerByIndex
SymbolServerByIndexW
SymbolServerClose
SymbolServerDeltaName
SymbolServerDeltaNameW
SymbolServerGetIndexString
SymbolServerGetIndexStringW
SymbolServerGetOptionData
SymbolServerGetOptions
SymbolServerGetSupplement
SymbolServerGetSupplementW
SymbolServerGetVersion
SymbolServerIsStore
SymbolServerIsStoreW
SymbolServerPing
SymbolServerPingW
SymbolServerPingWEx
SymbolServerSetOptions
SymbolServerSetOptionsW
SymbolServerStoreFile
SymbolServerStoreFileW
SymbolServerStoreSupplement
SymbolServerStoreSupplementW
SymbolServerW
SymbolServerWEx
httpCloseHandle
httpOpenFileHandle
httpOpenFileHandleW
httpQueryDataAvailable
httpReadFile

Sections

.text
Size: 82KB - Virtual size: 81KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 456B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.mrdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9ece4e7482be4ab6b4d79909aa1d087a

Code Sign

33:00:00:00:cc:cb:b8:13:eb:5d:72:2d:45:00:00:00:00:00:ccCertificate

Extended Key Usages

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40Certificate

Extended Key Usages

61:33:26:1a:00:00:00:00:00:31Certificate

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

33:00:00:01:4f:e7:c6:62:c9:46:f4:a9:7f:00:00:00:00:01:4fCertificate

Extended Key Usages

61:0c:52:4c:00:00:00:00:00:03Certificate

Key Usages

26:69:05:6d:f1:b4:bd:67:4e:e2:00:b6:79:59:45:0d:f5:c2:d2:8c:6d:14:ea:19:b6:f0:b4:b7:40:c9:f6:a2Signer

Signature Validations

Verification

13/04/2023, 18:10 Valid: false

10:c6:43:d2:ca:46:65:3f:6c:34:82:05:a3:66:e6:ba:17:22:bf:8bSigner

Signature Validations

Verification

18/03/2017, 09:29 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

api-ms-win-security-base-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-misc-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-libraryloader-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-localregistry-l1-1-0

ws2_32

api-ms-win-core-profile-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

advapi32

api-ms-win-core-memory-l1-1-0

api-ms-win-core-heap-l1-1-0

ntdll

Exports

Exports

Sections

.text Size: 82KB - Virtual size: 81KB

.rdata Size: 68KB - Virtual size: 68KB

.data Size: 1KB - Virtual size: 140KB

.pdata Size: 4KB - Virtual size: 4KB

.didat Size: 512B - Virtual size: 456B

.mrdata Size: 11KB - Virtual size: 11KB

.rsrc Size: 6KB - Virtual size: 6KB

.reloc Size: 2KB - Virtual size: 2KB

33:00:00:00:cc:cb:b8:13:eb:5d:72:2d:45:00:00:00:00:00:cc
Certificate

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

33:00:00:01:4f:e7:c6:62:c9:46:f4:a9:7f:00:00:00:00:01:4f
Certificate

61:0c:52:4c:00:00:00:00:00:03
Certificate

26:69:05:6d:f1:b4:bd:67:4e:e2:00:b6:79:59:45:0d:f5:c2:d2:8c:6d:14:ea:19:b6:f0:b4:b7:40:c9:f6:a2
Signer

13/04/2023, 18:10
Valid: false

10:c6:43:d2:ca:46:65:3f:6c:34:82:05:a3:66:e6:ba:17:22:bf:8b
Signer

18/03/2017, 09:29
Valid: false

.text
Size: 82KB - Virtual size: 81KB

.rdata
Size: 68KB - Virtual size: 68KB

.data
Size: 1KB - Virtual size: 140KB

.pdata
Size: 4KB - Virtual size: 4KB

.didat
Size: 512B - Virtual size: 456B

.mrdata
Size: 11KB - Virtual size: 11KB

.rsrc
Size: 6KB - Virtual size: 6KB

.reloc
Size: 2KB - Virtual size: 2KB